CN113904867B

CN113904867B - Flow processing method and system for VXLAN two-layer networking

Info

Publication number: CN113904867B
Application number: CN202111278402.4A
Authority: CN
Inventors: 王赛
Original assignee: Hangzhou DPTech Technologies Co Ltd
Current assignee: Hangzhou DPTech Technologies Co Ltd
Priority date: 2021-10-30
Filing date: 2021-10-30
Publication date: 2023-07-07
Anticipated expiration: 2041-10-30
Also published as: CN113904867A

Abstract

The present disclosure relates to a traffic processing method, system, electronic device, and computer readable medium for VXLAN two-layer networking. The method comprises the following steps: matching the flow data with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; forwarding the traffic data to a traffic cleaning device based on the destination tunnel address; the flow cleaning device analyzes the flow data to perform flow processing. The flow processing method, the system, the electronic equipment and the computer readable medium for the VXLAN two-layer networking, which are related by the disclosure, can discover abnormal flow in advance, achieve the purpose of flow cleaning through professional cleaning equipment, reduce network influence, reduce cost and strengthen expandability.

Description

Flow processing method and system for VXLAN two-layer networking

Technical Field

The present disclosure relates to the field of computer information processing, and in particular, to a flow processing method, system, electronic device, and computer readable medium for VXLAN two-layer networking.

Background

VXLAN (Virtual eXtensible Local Area Network, virtual extended local area network) is a network virtualization technology, which can improve the expansion problem of large cloud computing in deployment, and is an expansion of VLAN. VXLAN is a powerful tool that can extend two layers across three-layer networks. It can solve the portability limitation of VMS (virtual memory system) by encapsulating traffic and expanding it to a third layer gateway so that it can access servers on the external IP subnet. The VXLAN technology well solves the problem that the prior VLAN technology cannot meet the requirement of a large two-layer network. The VXLAN technology is a large two-layer virtual network technology, and the main principle is that an outer layer tunnel in UDP format is introduced as a data link layer, and the original data message content is transmitted as a tunnel payload. Since the outer layer adopts UDP as a transmission means, payload data can be easily transmitted in the two-layer network and the three-layer network.

However, the two-layer attack is also threatened after the two-layer network of the VXLAN is opened, and the conventional two-layer protection scheme is also struggled in the large two-layer network of the VXLAN.

Accordingly, there is a need for a new traffic handling method, system, electronic device, and computer readable medium for VXLAN two-layer networking.

The above information disclosed in the background section is only for enhancement of understanding of the background of the disclosure and therefore it may include information that does not form the prior art that is already known to a person of ordinary skill in the art.

Disclosure of Invention

In view of this, the present disclosure provides a flow processing method, a system, an electronic device, and a computer readable medium for VXLAN two-layer networking, which can discover abnormal flow in advance, achieve a flow cleaning purpose by a professional cleaning device, reduce network impact, reduce cost, and enhance expandability.

Other features and advantages of the present disclosure will be apparent from the following detailed description, or may be learned in part by the practice of the disclosure.

According to an aspect of the present disclosure, there is provided a traffic processing method for VXLAN two-layer networking, the method comprising: matching the flow data with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; forwarding the traffic data to a traffic cleaning device based on the destination tunnel address; the flow cleaning device analyzes the flow data to perform flow processing.

In an exemplary embodiment of the present disclosure, further comprising: the flow analysis equipment acquires flow data; when abnormal attack traffic exists in the traffic data, extracting a destination data link layer address and an access interface of the abnormal attack traffic; generating a data link layer address table entry based on the destination data link layer address; and issuing the data link layer address table entry to the ingress interface of the core switch.

In an exemplary embodiment of the present disclosure, before the flow analysis device acquires the flow data, the flow analysis device further includes: the core switch enables a port sampling function; and draining the input flow data into the flow analysis equipment based on the port sampling function.

In one exemplary embodiment of the present disclosure, issuing the data link layer address table entry into the ingress interface of the core switch includes: and issuing the data link layer address list item to the preset address list of a two-layer forwarding domain of the ingress interface of the core switch.

In one exemplary embodiment of the present disclosure, before forwarding the traffic data to a traffic washing device based on the destination tunnel address, the method includes: enabling VXLAN functionality in the traffic cleaning device; a network virtualization technique based on a generic routing protocol encapsulation establishes a tunnel between a core switch and the traffic washing device.

In one exemplary embodiment of the present disclosure, forwarding the traffic data to a traffic washing device based on the destination tunnel address includes: the core switch forwards the traffic data to a traffic washing device based on the destination tunnel address.

In one exemplary embodiment of the present disclosure, the flow washer device analyzes the flow data for flow processing, comprising: the flow cleaning equipment unpacks the flow data; analyzing the flow data after the deblocking; and when the analysis result does not meet the preset strategy, the flow data is reinjected to the core switch.

In an exemplary embodiment of the present disclosure, the flow cleaning device analyzes the flow data for flow processing, further comprising: and discarding the flow data when the analysis result meets a preset strategy.

In one exemplary embodiment of the present disclosure, reinjecting the traffic data to a core switch includes: obtaining a virtual switching instance based on the decapsulation; determining entry information based on the virtual switching instance; and packaging the flow data based on the table item information to reinject the flow data.

In one exemplary embodiment of the present disclosure, determining entry information based on a virtual switch instance includes: determining a two-layer switching service instance based on the virtual switching instance; determining a forwarding domain based on the two-layer switching service instance; and acquiring the table entry information in the forwarding domain.

According to one aspect of the present disclosure, there is provided a traffic processing system for VXLAN two-layer networking, the system comprising: the flow analysis device is used for matching the flow data with the data link layer address in the preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; the core switch is used for forwarding the traffic data to the traffic cleaning equipment based on the destination tunnel address; and the flow cleaning device is used for analyzing the flow data to perform flow processing.

In an exemplary embodiment of the present disclosure, further comprising: the core switch is also used for guiding the input flow data to the flow analysis equipment; the flow analysis device is also used for acquiring flow data; when abnormal attack traffic exists in the traffic data, extracting a destination data link layer address and an access interface of the abnormal attack traffic; generating a data link layer address table entry based on the destination data link layer address; and issuing the data link layer address table entry to the ingress interface of the core switch.

In an exemplary embodiment of the present disclosure, further comprising: the flow cleaning device is also used for decapsulating the flow data; analyzing the flow data after the deblocking; and when the analysis result does not meet the preset strategy, the flow data is reinjected to the core switch.

According to an aspect of the present disclosure, there is provided an electronic device including: one or more processors; a storage means for storing one or more programs; when the one or more programs are executed by the one or more processors, the one or more processors are caused to implement the methods as described above.

According to an aspect of the present disclosure, a computer-readable medium is presented, on which a computer program is stored, which program, when being executed by a processor, implements a method as described above.

According to the flow processing method, the system, the electronic equipment and the computer readable medium for the VXLAN two-layer network, the flow data are matched with the data link layer address in the preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; forwarding the traffic data to a traffic cleaning device based on the destination tunnel address; the flow cleaning equipment analyzes the flow data to perform flow processing, so that abnormal flow can be found in advance, the purpose of flow cleaning is achieved through the professional cleaning equipment, the network influence is reduced, the cost is reduced, and the expandability is enhanced.

It is to be understood that both the foregoing general description and the following detailed description are exemplary and explanatory only and are not restrictive of the disclosure.

Drawings

The above and other objects, features and advantages of the present disclosure will become more apparent by describing in detail exemplary embodiments thereof with reference to the attached drawings. The drawings described below are merely examples of the present disclosure and other drawings may be obtained from these drawings without inventive effort for a person of ordinary skill in the art.

Fig. 1 is a block diagram illustrating a traffic processing system for a VXLAN two-layer network, according to an example embodiment.

Fig. 2 is a schematic diagram illustrating an application of a traffic processing system for VXLAN two-layer networking, according to an example embodiment.

Fig. 3 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to an example embodiment.

Fig. 4 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment.

Fig. 5 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment.

Fig. 6 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment.

Fig. 7 is a block diagram of an electronic device, according to an example embodiment.

Fig. 8 is a block diagram of a computer-readable medium shown according to an example embodiment.

Detailed Description

Example embodiments will now be described more fully with reference to the accompanying drawings. However, the exemplary embodiments can be embodied in many forms and should not be construed as limited to the embodiments set forth herein; rather, these embodiments are provided so that this disclosure will be thorough and complete, and will fully convey the concept of the example embodiments to those skilled in the art. The same reference numerals in the drawings denote the same or similar parts, and thus a repetitive description thereof will be omitted.

Furthermore, the described features, structures, or characteristics may be combined in any suitable manner in one or more embodiments. In the following description, numerous specific details are provided to give a thorough understanding of embodiments of the disclosure. One skilled in the relevant art will recognize, however, that the disclosed aspects may be practiced without one or more of the specific details, or with other methods, components, devices, steps, etc. In other instances, well-known methods, systems, implementations, or operations have not been shown or described in detail to avoid obscuring aspects of the disclosure.

The block diagrams depicted in the figures are merely functional entities and do not necessarily correspond to physically separate entities. That is, the functional entities may be implemented in software, or in one or more hardware modules or integrated circuits, or in different networks and/or processor devices and/or microcontroller devices.

The flow diagrams depicted in the figures are exemplary only, and do not necessarily include all of the elements and operations/steps, nor must they be performed in the order described. For example, some operations/steps may be decomposed, and some operations/steps may be combined or partially combined, so that the order of actual execution may be changed according to actual situations.

It will be understood that, although the terms first, second, third, etc. may be used herein to describe various components, these components should not be limited by these terms. These terms are used to distinguish one element from another element. Accordingly, a first component discussed below could be termed a second component without departing from the teachings of the concepts of the present disclosure. As used herein, the term "and/or" includes any one of the associated listed items and all combinations of one or more.

Those skilled in the art will appreciate that the drawings are schematic representations of example embodiments and that the modules or flows in the drawings are not necessarily required to practice the present disclosure, and therefore, should not be taken to limit the scope of the present disclosure.

The technical abbreviations to which the present disclosure relates are explained as follows:

flow rate: refers to the forwarded data message aggregate;

flow cleaning: intercepting attacks contained in the traffic and reinjecting normal traffic to the network;

flow cleaning center: the flow cleaning system can pull the flow to the cleaning system for cleaning and reinject normal service flow;

reinjection: after cleaning, retransmitting the normal service flow back to the router;

VXLAN: virtual eXtensible Local Area Network, virtual expansion lan;

VTEP: an actual VXLAN tunnel endpoint;

tunnel: adopting a flow-through channel with a certain encapsulation format, wherein the message in the tunnel meets the encapsulation format of the tunnel;

VXLAN inner layer: after adding the VXLAN header, the message in the VXLAN header is the same as the message when the VXLAN is not added for encapsulation;

VXLAN outer layer: after adding the VXLAN sealing device, using the UDP message of the opposite end of the VXLAN tunnel as a target IP as an outer layer message;

NVGRE: network Virtualization using Generic Routing Encapsulation, i.e. network virtualization technology encapsulated using the generic routing protocol;

NVE: network Virtualization Edge, network virtualized edge devices;

NVGRE tunnel: a point-to-point logical tunnel between two NVEs;

core device: a device in an IP core network;

mac address: a data link layer address;

VSI: virtual Switch Instance virtual switching instance, virtual switching instance on NVE providing two-layer switching service for an NVGRE network;

VNI: VXLAN Network Identifier a VXLAN network identifier, similar to the vlan id in the vlan, is used to identify the two-layer switched service instance in the VXLAN.

The inventor of the present disclosure finds that in the conventional networking scheme, two layers of protection often perform traffic protection on an endpoint, that is, after the traffic reaches an endpoint of a device, whether the relevant traffic is attack traffic is judged, and then relevant actions are taken; more specifically, a brute force port mac address binding scheme or an ip and mac address binding scheme can be adopted to block other traffic, and in a large two-layer network of the VXLAN, because of newly added two-layer elements such as VXLAN tunnels and mac address migration, the original scheme cannot fully use the existing networking environment.

If mac address binding, port security and other means are adopted to protect, the two-layer flow entering from the tunnel end cannot be bound with the port, and after mac address migration, the mac address migration attribute which is required to be supported in the VXLAN two-layer networking environment is often not in the originally corresponding port, even the equipment is different, so that the original two-layer protection is far from the actual protection requirement in the two-layer networking.

The flow processing method and the flow processing system for the VXLAN two-layer networking mainly provide a networking scheme for draining flow to professional cleaning equipment for flow cleaning in a large two-layer environment of the VXLAN network, can solve the problems such as newly added virtual machines, virtual machine migration and the like which cannot be solved by the traditional protection means in the VXLAN network, and reduces manual configuration. The following is a detailed description based on specific examples.

Fig. 1 is a block diagram illustrating a traffic processing system for a VXLAN two-layer network, according to an example embodiment. As shown in fig. 1, a traffic processing system 10 for a VXLAN two-layer network may include: traffic analysis device 102, core switch 104, traffic cleaning device 106.

The traffic analysis device 102 is configured to match traffic data with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol;

the core switch 104 is configured to forward the traffic data to the traffic cleaning device 106 based on the destination tunnel address;

the flow washer 106 is configured to analyze the flow data for flow processing.

Further, the core switch 104 is further configured to stream the incoming traffic data to the traffic analysis device 102;

the flow analysis device 102 is further configured to obtain flow data; when abnormal attack traffic exists in the traffic data, extracting a destination data link layer address and an access interface of the abnormal attack traffic; generating a data link layer address table entry based on the destination data link layer address; the data link layer address table entry is issued into the ingress interface of the core switch 104.

The traffic washing device 106 is further configured to decapsulate the traffic data; analyzing the flow data after the deblocking; and when the analysis result does not meet the preset strategy, the traffic data is reinjected to the core switch 104.

According to the flow processing system method for the VXLAN two-layer network, matching is carried out on flow data and a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; forwarding the traffic data to a traffic cleaning device based on the destination tunnel address; the flow cleaning equipment analyzes the flow data to perform flow processing, so that abnormal flow can be found in advance, the purpose of flow cleaning is achieved through the professional cleaning equipment, the network influence is reduced, the cost is reduced, and the expandability is enhanced.

Fig. 2 is a schematic diagram illustrating an application of a traffic processing system for VXLAN two-layer networking, according to an example embodiment. As shown in fig. 2, the system architecture 20 may include end devices 201, 202, general switches 203, 204, a core switch 205, a traffic analysis device 206, and a traffic cleaning device 207. The network is used to provide a medium for communication links between the terminal devices 201, 202, the general switches 203, 204, the core switch 205, the traffic analysis device 206, and the traffic washing device 207. The network may include various connection types, such as wired, wireless communication links, or fiber optic cables, among others.

The user can interact with the general switch 203 through the network using the terminal device 201, and the general switch 203 forwards the traffic data on the terminal device 201 to the general switch 204 through the core switch 205, and then sends the traffic data to the terminal device 202. To enable information interaction between the terminal devices 201, 202. Various communication client applications, such as shopping class applications, web browser applications, search class applications, instant messaging tools, mailbox clients, social platform software, etc., may be installed on the terminal devices 201, 202.

The terminal devices 201, 202 may be various electronic devices having a display screen and supporting web browsing, including but not limited to smartphones, tablets, laptop and desktop computers, and the like.

During the process of forwarding traffic by the core switch 205, the traffic analysis device 206 and the traffic cleaning device 207 may assist in traffic processing.

The core switch 205 may, for example, stream incoming traffic data into the traffic analysis device 206;

the flow analysis device 206 may, for example, obtain flow data; when abnormal attack traffic exists in the traffic data, extracting a destination data link layer address and an access interface of the abnormal attack traffic; generating a data link layer address table entry based on the destination data link layer address; the data link layer address table entry is issued into the ingress interface of the core switch 205.

The traffic analysis device 206 may, for example, match traffic data with data link layer addresses in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; core switch 205 may forward the traffic data to a traffic washing device, e.g., based on the destination tunnel address; the flow washer device may for example analyze the flow data for flow processing 207.

The traffic washing device 207 may, for example, decapsulate the traffic data; analyzing the flow data after the deblocking; and when the analysis result does not meet the preset strategy, the flow data is reinjected to the core switch.

It should be noted that, the traffic processing method for VXLAN two-layer network provided in the embodiments of the present disclosure may be executed by the core switch 205, the traffic analysis device 206, the traffic cleaning device 207,

fig. 3 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to an example embodiment. The traffic processing method 30 for VXLAN two-layer networking includes at least steps S302 to S308.

More specifically, the core switch is located at a core position in the VXLAN network, and the core switch deploys VXLAN functions, so that the core switch can support a traffic sampling function: sflow, or netflow, etc. for sampling switch traffic and sending to traffic monitoring devices, the core switch may also have NVGRE function for pulling the attack traffic after detecting the attack traffic.

As shown in fig. 3, in S302, the traffic data is matched with the data link layer address in the preset address table.

In S304, when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol. And when the attack traffic is successfully matched, the attack traffic reaching the core switch is sent to the traffic cleaning equipment through the NVGRE tunnel.

In S306, the traffic data is forwarded to a traffic washing device based on the destination tunnel address. The core switch forwards the traffic data to a traffic washing device based on the destination tunnel address.

Wherein before forwarding the traffic data to a traffic washing device based on the destination tunnel address, the method comprises: enabling VXLAN functionality in the traffic cleaning device; a network virtualization technique based on a generic routing protocol encapsulation establishes a tunnel between a core switch and the traffic washing device.

In S308, the flow rate cleaning device analyzes the flow rate data to perform flow rate processing.

According to the flow processing method for the VXLAN two-layer network, flow data are matched with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol; forwarding the traffic data to a traffic cleaning device based on the destination tunnel address; the flow cleaning equipment analyzes the flow data to perform flow processing, so that abnormal flow can be found in advance, the purpose of flow cleaning is achieved through the professional cleaning equipment, the network influence is reduced, the cost is reduced, and the expandability is enhanced.

It should be clearly understood that this disclosure describes how to make and use particular examples, but the principles of this disclosure are not limited to any details of these examples. Rather, these principles can be applied to many other embodiments based on the teachings of the present disclosure.

Fig. 4 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment. The flow 40 shown in fig. 4 is a complementary description of the flow shown in fig. 3.

As shown in fig. 4, in S402, the flow analysis device acquires flow data.

Before the flow analysis device obtains the flow data, the flow analysis device further comprises: the core switch enables a port sampling function; and draining the input flow data into the flow analysis equipment based on the port sampling function.

More specifically, the flow analysis device is connected with the switch, the port sampling function is enabled in the central switch, the functions may be sflow, netflow and the like, the incoming direction message of the monitoring acquisition interface is transmitted to the flow analysis device, and the flow analysis device analyzes whether the actual flow contains attack flow or not.

In S404, when there is an abnormal attack traffic in the traffic data, the destination data link layer address and the ingress interface of the abnormal attack traffic are extracted. When abnormal attack traffic is detected to reach the core switch, the destination mac address of the attack traffic is obtained through the traffic collection and traffic analysis equipment, and the attack traffic enters an inlet of the core switch.

In S406, a data link layer address table entry is generated based on the destination data link layer address. After the target mac address of the attack message is obtained through monitoring, a mac address table item is issued in a two-layer forwarding domain mac address forwarding table where a sampling port is located on the core switch, the mac address is the target mac address of the attack message, and the output interface is a tunnel of NVGRE.

In S408, the data link layer address table entry is issued into the ingress interface of the core switch. Comprising the following steps: and issuing the data link layer address list item to the preset address list of a two-layer forwarding domain of the ingress interface of the core switch. It should be noted that, in the mac address table, the mac address table entry of the NVGRE and the mac address table entry of the VXLAN coexist, but the priority of the table entry of the NVGRE is higher than that of the mac address table entry of the VXLAN, and also needs to be higher than that of the local mac address forwarding table entry. In the lock encapsulated NVGRE header, the VSI value is the same as the VNI value required to check VXLAN egress.

In one embodiment, when the traffic analysis device analyzes that the attack traffic in the sampled packet has disappeared, the mac address table entry of the NVGRE sampled on the core switch, for example, in the two-layer domain where the interface is located, is deleted, and then the traffic goes through the normal VXLAN tunnel encapsulation or the local forwarding table.

Fig. 5 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment. The flow 50 shown in fig. 5 is a detailed description of S308 "the flow cleaning device analyzes the flow data for flow processing" in the flow shown in fig. 3.

The flow cleaning device can be hung beside the core switch, an NVGRE tunnel is established between the core switch and the flow cleaning device, the VXLAN function is enabled by the flow cleaning device, and the VXLAN tunnel is established with the core switch. In addition, when NVGRE and VXLAN are specifically deployed, the VNI of VXLAN should be corresponded to the VSI of NVGRE, the numbers are corresponded and the values are the same.

As shown in fig. 5, in S502, the traffic washing apparatus decapsulates the traffic data.

In S504, the traffic data after the decapsulation is analyzed. After the flow cleaning equipment receives the flow from the core switch through the NVGRE tunnel, a corresponding message is obtained by unpacking NVGRE, the message is analyzed, and then the relevant attack message is discarded, so that the cleaning purpose is achieved.

In S506, the preset policies are compared.

In S508, when the analysis result does not meet the preset policy, the traffic data is reinjected to the core switch.

A virtual switch instance may be obtained, for example, based on the decapsulation; determining entry information based on the virtual switching instance; and packaging the flow data based on the table item information to reinject the flow data.

Wherein determining entry information based on the virtual switch instance comprises: determining a two-layer switching service instance based on the virtual switching instance; determining a forwarding domain based on the two-layer switching service instance; and acquiring the table entry information in the forwarding domain.

More specifically, when the traffic cleaning device determines that the normal traffic which does not need to be cleaned is normal, the normal traffic needs to be reinjected to the core switch, more specifically, a VXLAN tunnel needs to be established between the core switch and the traffic cleaning device, the core switch and the traffic cleaning device need to synchronize two layers of table items of the VXLAN, and after the core switch packages the VSI of the NVGRE which is the same as the two layers of domains corresponding to the VNI of the two layers of VXLAN at the time, the core switch is sent to the traffic cleaning device. After the flow cleaning equipment is unpacked, the VSI is used for determining the VNI required by reinjection, further determining the required VXLAN forwarding domain, looking up the mac address table in the corresponding domain, then matching the related table entries, and adding the VXLAN package to the core switch.

After the core switch analyzes the VXLAN header, the core switch performs VXLAN two-layer forwarding on the forwarding domain corresponding to the VNI value carried in the VXLAN header corresponding to the traffic check.

In S510, when the analysis result satisfies the preset policy, the traffic data is discarded.

Fig. 6 is a flow chart illustrating a method of traffic handling for a VXLAN two-layer network, according to another example embodiment. The flow 60 shown in fig. 6 is a description of the operation of the traffic processing system for VXLAN two-layer networking.

In S601, the core switch streams the input traffic data to the traffic analysis device.

In S602, when there is an abnormal attack traffic in the traffic data, the traffic analysis device extracts a destination data link layer address and an ingress interface of the abnormal attack traffic; and generating a data link layer address table entry based on the destination data link layer address.

In S603, the traffic analysis device issues the data link layer address table entry into the ingress interface of the core switch.

In S604, the core switch streams the input traffic data into the traffic analysis device.

In S605, the traffic analysis device matches the traffic data with the data link layer address in the preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol.

In S606, the traffic analysis device transmits the destination tunnel address to the core switch.

In S607, the core switch forwards the traffic data to the traffic washing device based on the destination tunnel address.

In S608, the traffic cleaning device decapsulates the traffic data; analyzing the flow data after the deblocking;

in S609, when the analysis result does not meet the preset policy, the traffic data is reinjected to the core switch.

According to the flow processing method for the VXLAN two-layer network, the following advantages are brought:

traction reinjection can be performed in the VXLAN network;

the purpose of flow cleaning is achieved by using externally hung professional cleaning equipment;

the flow is thoroughly cleaned, abnormal flow is found earlier, and the network influence is reduced;

the cost is reduced;

the scalability is enhanced.

Those skilled in the art will appreciate that all or part of the steps implementing the above described embodiments are implemented as a computer program executed by a CPU. The above-described functions defined by the above-described methods provided by the present disclosure are performed when the computer program is executed by a CPU. The program may be stored in a computer readable storage medium, which may be a read-only memory, a magnetic disk or an optical disk, etc.

Furthermore, it should be noted that the above-described figures are merely illustrative of the processes involved in the method according to the exemplary embodiments of the present disclosure, and are not intended to be limiting. It will be readily appreciated that the processes shown in the above figures do not indicate or limit the temporal order of these processes. In addition, it is also readily understood that these processes may be performed synchronously or asynchronously, for example, among a plurality of modules.

An electronic device 700 according to such an embodiment of the present disclosure is described below with reference to fig. 7. The electronic device 700 shown in fig. 7 is merely an example and should not be construed to limit the functionality and scope of use of embodiments of the present disclosure in any way.

As shown in fig. 7, the electronic device 700 is embodied in the form of a general purpose computing device. Components of electronic device 700 may include, but are not limited to: at least one processing unit 710, at least one memory unit 720, a bus 730 connecting the different system components (including the memory unit 720 and the processing unit 710), a display unit 740, and the like.

Wherein the storage unit stores program code that is executable by the processing unit 710 such that the processing unit 710 performs steps described in the present specification according to various exemplary embodiments of the present disclosure. For example, the processing unit 710 may perform the steps as shown in fig. 3, 4, 5, and 6.

The memory unit 720 may include readable media in the form of volatile memory units, such as Random Access Memory (RAM) 7201 and/or cache memory 7202, and may further include Read Only Memory (ROM) 7203.

The storage unit 720 may also include a program/utility 7204 having a set (at least one) of program modules 7205, such program modules 7205 including, but not limited to: an operating system, one or more application programs, other program modules, and program data, each or some combination of which may include an implementation of a network environment.

Bus 730 may be a bus representing one or more of several types of bus structures including a memory unit bus or memory unit controller, a peripheral bus, an accelerated graphics port, a processing unit, or a local bus using any of a variety of bus architectures.

The electronic device 700 may also communicate with one or more external devices 700' (e.g., keyboard, pointing device, bluetooth device, etc.), devices that enable a user to interact with the electronic device 700, and/or any devices (e.g., routers, modems, etc.) with which the electronic device 700 can communicate with one or more other computing devices. Such communication may occur through an input/output (I/O) interface 750. Also, electronic device 700 may communicate with one or more networks such as a Local Area Network (LAN), a Wide Area Network (WAN) and/or a public network, such as the Internet, through network adapter 760. Network adapter 760 may communicate with other modules of electronic device 700 via bus 730. It should be appreciated that although not shown, other hardware and/or software modules may be used in connection with electronic device 700, including, but not limited to: microcode, device drivers, redundant processing units, external disk drive arrays, RAID systems, tape drives, data backup storage systems, and the like.

From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or may be implemented in software in combination with the necessary hardware. Thus, as shown in fig. 8, the technical solution according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and includes several instructions to cause a computing device (may be a personal computer, a server, or a network device, etc.) to perform the above-described method according to the embodiments of the present disclosure.

The software product may employ any combination of one or more readable media. The readable medium may be a readable signal medium or a readable storage medium. The readable storage medium can be, for example, but is not limited to, an electronic, magnetic, optical, electromagnetic, infrared, or semiconductor system, apparatus, or device, or a combination of any of the foregoing. More specific examples (a non-exhaustive list) of the readable storage medium would include the following: an electrical connection having one or more wires, a portable disk, a hard disk, random Access Memory (RAM), read-only memory (ROM), erasable programmable read-only memory (EPROM or flash memory), optical fiber, portable compact disk read-only memory (CD-ROM), an optical storage device, a magnetic storage device, or any suitable combination of the foregoing.

The computer readable storage medium may include a data signal propagated in baseband or as part of a carrier wave, with readable program code embodied therein. Such a propagated data signal may take any of a variety of forms, including, but not limited to, electro-magnetic, optical, or any suitable combination of the foregoing. A readable storage medium may also be any readable medium that can communicate, propagate, or transport a program for use by or in connection with an instruction execution system, apparatus, or device. Program code embodied on a readable storage medium may be transmitted using any appropriate medium, including but not limited to wireless, wireline, optical fiber cable, RF, etc., or any suitable combination of the foregoing.

Program code for carrying out operations of the present disclosure may be written in any combination of one or more programming languages, including an object oriented programming language such as Java, C++ or the like and conventional procedural programming languages, such as the "C" programming language or similar programming languages. The program code may execute entirely on the user's computing device, partly on the user's device, as a stand-alone software package, partly on the user's computing device, partly on a remote computing device, or entirely on the remote computing device or server. In the case of remote computing devices, the remote computing device may be connected to the user computing device through any kind of network, including a Local Area Network (LAN) or a Wide Area Network (WAN), or may be connected to an external computing device (e.g., connected via the Internet using an Internet service provider).

The computer-readable medium carries one or more programs, which when executed by one of the devices, cause the computer-readable medium to perform the functions of: matching the flow data with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol. The computer readable medium may also implement the following functions: and forwarding the traffic data to a traffic washing device based on the destination tunnel address. The computer readable medium may also implement the following functions: and analyzing the flow data to perform flow processing.

Those skilled in the art will appreciate that the modules may be distributed throughout several devices as described in the embodiments, and that corresponding variations may be implemented in one or more devices that are unique to the embodiments. The modules of the above embodiments may be combined into one module, or may be further split into a plurality of sub-modules.

From the above description of embodiments, those skilled in the art will readily appreciate that the example embodiments described herein may be implemented in software, or in combination with the necessary hardware. Thus, the technical solutions according to the embodiments of the present disclosure may be embodied in the form of a software product, which may be stored in a non-volatile storage medium (may be a CD-ROM, a U-disk, a mobile hard disk, etc.) or on a network, and include several instructions to cause a computing device (may be a personal computer, a server, a mobile terminal, or a network device, etc.) to perform the method according to the embodiments of the present disclosure.

Exemplary embodiments of the present disclosure are specifically illustrated and described above. It is to be understood that this disclosure is not limited to the particular arrangements, instrumentalities and methods of implementation described herein; on the contrary, the disclosure is intended to cover various modifications and equivalent arrangements included within the spirit and scope of the appended claims.

Claims

1. A traffic processing method for a VXLAN two-layer network, comprising:

the core switch enables a port sampling function;

the input flow data is led to flow analysis equipment based on the port sampling function;

the flow analysis equipment acquires flow data;

when abnormal attack traffic exists in the traffic data, extracting a destination data link layer address and an access interface of the abnormal attack traffic;

generating a data link layer address table entry based on the destination data link layer address;

issuing the data link layer address table entry into the ingress interface of the core switch;

matching the flow data with a data link layer address in a preset address table;

when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol;

enabling VXLAN functionality in the traffic cleaning device;

establishing a tunnel between a core switch and the flow cleaning equipment based on a network virtualization technology packaged by a universal routing protocol;

forwarding the traffic data to a traffic cleaning device based on the destination tunnel address;

the flow cleaning device analyzes the flow data to perform flow processing.

2. The method of claim 1, wherein issuing the data link layer address table entry into the ingress interface of the core switch comprises:

and issuing the data link layer address list item to the preset address list of a two-layer forwarding domain of the ingress interface of the core switch.

3. The method of claim 1, wherein forwarding the traffic data to a traffic washing device based on the destination tunnel address comprises:

the core switch forwards the traffic data to a traffic washing device based on the destination tunnel address.

4. The method of claim 1, wherein the flow washer device analyzing the flow data for flow processing, comprising:

the flow cleaning equipment unpacks the flow data;

analyzing the flow data after the deblocking;

and when the analysis result does not meet the preset strategy, the flow data is reinjected to the core switch.

5. The method of claim 4, wherein the flow washer device analyzes the flow data for flow processing, further comprising:

and discarding the flow data when the analysis result meets a preset strategy.

6. The method of claim 4, wherein reinjecting the traffic data to a core switch comprises:

obtaining a virtual switching instance based on the decapsulation;

determining entry information based on the virtual switching instance;

and packaging the flow data based on the table item information to reinject the flow data.

7. The method of claim 6, wherein determining entry information based on the virtual switch instance comprises:

determining a two-layer switching service instance based on the virtual switching instance;

determining a forwarding domain based on the two-layer switching service instance;

and acquiring the table entry information in the forwarding domain.

8. A traffic processing system for a VXLAN two-layer network, comprising:

the traffic analysis equipment is used for acquiring traffic data, and extracting a destination data link layer address and an access interface of the abnormal attack traffic when the abnormal attack traffic exists in the traffic data; generating a data link layer address table entry based on the destination data link layer address; issuing the data link layer address table entry into the ingress interface of the core switch; matching the flow data with a data link layer address in a preset address table; when the matching is successful, extracting a destination tunnel address from the preset address table; the tunnel address is a logical tunnel address based on a network virtualization technology encapsulated by a universal routing protocol;

the core switch is used for guiding the input flow data to the flow analysis equipment, enabling the VXLAN function in the flow cleaning equipment, establishing a tunnel between the core switch and the flow cleaning equipment based on a network virtualization technology packaged by a universal routing protocol, and forwarding the flow data to the flow cleaning equipment based on the destination tunnel address;

and the flow cleaning device is used for analyzing the flow data to perform flow processing.

9. The system as recited in claim 8, further comprising:

the flow cleaning device is also used for decapsulating the flow data; analyzing the flow data after the deblocking; and when the analysis result does not meet the preset strategy, the flow data is reinjected to the core switch.